Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Url regex changes #302

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Url regex changes #302

wants to merge 2 commits into from

Commits on Nov 9, 2015

  1. Updating URL Regex 

    The old URL regex had a few issues which were revealed by fuzzing,
the biggest being that it accepted non-printable characters (e.g.
0x00 or 0x01) as part of the URL.

This created the scenario where a url of https://example.com/[0x00]
would be rendered as %2 (and attempting to open the link would give
a value like "https://example.com https://example.com " due to some
odd iteraction with the regex that I haven't quite worked out.

The new regex appears to work with all the iterations I have tried
and rejects non-printable characters.
    @s-rah
    s-rah committed Nov 9, 2015
    Configuration menu
    Copy the full SHA
    6a10ce3 View commit details
    Browse the repository at this point in the history

  2. Prevents Bidi Phishing 

    Prevent attempts at phishing through unicode direction controls
by forcing left-to-right display for links through html
entity ‪

This is a fairly minor risk as a victim would have to go through many
hoops and not see the obvious url issues. But better fixed than not.
    @s-rah
    s-rah committed Nov 9, 2015
    Configuration menu
    Copy the full SHA
    c62a7d1 View commit details
    Browse the repository at this point in the history